Unfortunately, on Android messages are not permanently deleted. When files are “deleted” on Android, really all that happens is the operating system labels the disk space that stores the file as free space. The data is still there, and off-the-shelf data recovery tools can easily recover it. What do we do about this? There are numerous free apps in the Google Play Store, Secure Eraser, that will allow you to delete these files properly. Tools like Secure Eraser write over the so-called free space with random data. You should probably install and use a tool like this to remove all “deleted" data.

Another complicating issue is, if you're using an iPhone, SMS messages are being bundled together with iMessage messages (Apple's messaging platform). By default, if you are sending a message from an iPhone to a recipient with an iPhone it is sent through iMessage. That means Apple servers store patient data and it has travelled overseas. You should turn off iMessage if you wish to use SMS for sending patient data.

iOS

Turn off iMessage and send via SMS only.

Open the Settings app.

Scroll down and tap the Messages row.

Turn the iMessage switch off.

Finally, we also have the issue of messages being stored indefinably on the recipient's device. For this, we don't have a solution other than avoiding sending unencrypted patient data via text message. By sending a photo to a colleague, you are:

Putting your colleague in an awkward position because they are now storing patient data on their phone, and

Putting yourself in an awkward position because you can't control that patient data. If your colleague loses their phone, there is a privacy breach for which you are responsible.